Cyprus cookie consent: audit scripts, choices and withdrawal

Inventory cookies and similar storage or access

Begin with the pages and features people actually use: homepage, contact form, booking flow, article, campaign landing page and embedded media. Observe cookies, local storage and requests that access information on the visitor’s device. A list copied from a cookie scanner can be useful, but it may miss a script that loads only after a particular button, query parameter or return visit.

For each item, record the provider, name or identifier, purpose, category, duration and whether it is first or third party. Link it to the feature that causes it to load. Check whether the same tool sets multiple identifiers or transmits information before writing a cookie. A script can create a privacy issue even when the browser’s cookie table appears short.

Repeat the inventory with a fresh profile and with a returning visitor profile. Use the browsers and devices important to the service. Preserve the date, configuration and observed network evidence. This gives the team a concrete baseline and makes later changes easier to detect. An unverified vendor list should be marked as vendor information rather than presented as a confirmed account of the deployed site.

Classify strictly necessary functions narrowly

The Cyprus Commissioner describes narrow exceptions for technical transmission and storage or access strictly necessary to provide a service expressly requested by the visitor. A technology is not necessary merely because it helps the business measure performance or market its services. Evaluate the purpose in the actual context and document why the visitor-requested service could not work without it.

A preference that remembers a visitor’s consent choice can be necessary for operating the consent system. Analytics remains an optional category under the Commissioner’s guidance even though it gives useful business statistics. A third-party tool may serve both an essential and an optional function; separate them where technically possible instead of putting the entire provider under an essential label.

Check each item again when a feature changes. A booking embed might initially be disabled until a visitor asks to open it, while an unconditional load on every page would be a different arrangement. The classification should reflect how the site behaves now. Keep the reasoning accessible to the developer, privacy owner and person responsible for the public notice.

Basis and guidance: Cyprus Commissioner: cookies guidance

Block optional technology before a valid choice

Open the site in a fresh browser profile and inspect both storage and network activity before pressing any banner button. Optional analytics, advertising or similar technology that requires consent should not be activated merely because the banner is visible. The Cyprus guidance requires consent before the relevant storage or access begins. Check scripts loaded through tag managers as well as scripts hardcoded in pages.

Do not treat scrolling, continued browsing, a closed banner or an idle timeout as affirmative consent. The Commissioner and EDPB guidance make this clear. If a visitor dismisses the interface without choosing, verify that optional technology remains off and that the site does not silently create an accepted preference. A necessary preference marker may record that no optional consent has been given.

Test the actual deployed domain, not just a development build. Configuration can differ in production, especially for analytics IDs, advertising tags, consent mode and embedded suppliers. Capture a reproducible sequence with a clean profile, page URL, expected category state and observed requests. If a request cannot be explained, investigate it before concluding that the pre-consent state is correct.

Basis and guidance: Cyprus Commissioner: cookies guidance; EDPB: Guidelines 05/2020 on consent

Offer a real choice for each optional purpose

Provide a clear way to accept, reject and choose optional categories. The Cyprus Commissioner says acceptance and rejection should require the same number of actions from the same interface level. Compare the actual path a visitor takes, not only the number of buttons in a design file. A rejection hidden behind several screens while acceptance is immediate does not meet that guidance.

Optional categories should start off. Preselected boxes do not produce valid consent under the EDPB guidance. When a visitor saves only an analytics choice, verify that marketing remains off. When both are rejected, verify that neither later loads on another page. Keep essential functions available without presenting them as a switch that the visitor can disable if the site cannot operate that way.

Check presentation and accessibility alongside the words. Labels should explain the consequence of the action; focus order, keyboard access and contrast should let people make either choice. The EDPB taskforce calls for assessment of designs that may steer users. The Cyprus guidance specifically warns against influencing acceptance through different font sizes. Test the compact mobile layout as carefully as the desktop banner.

Basis and guidance: Cyprus Commissioner: cookies guidance; EDPB: Cookie Banner Taskforce report

Explain purposes and providers before asking

The first layer should tell the visitor what optional categories are used and link to details. The Commissioner accepts layered information where the person can understand the categories before making a choice. The detailed information should identify the actual cookies or comparable technologies, their purpose, duration and relevant third parties. A generic paragraph about improving experience does not describe a tracking tool adequately.

Match the public list to the inventory. If an advertising pixel was removed, remove its stale entry; if a new booking or analytics vendor was added, review its activity and update the information before activation. Avoid copying a provider’s default language that describes features not enabled on this site. The notice should reflect the deployed configuration, not every service the vendor might offer.

Use consistent category names in the banner and detailed notice. Explain whether a particular embed remains inactive until requested and what happens after a visitor enables it. A link to a privacy policy in another language may leave the visitor without useful information. Ensure the material is understandable in the languages in which the site seeks the visitor’s choice.

Basis and guidance: Cyprus Commissioner: cookies guidance

Verify the saved choice across pages and sessions

Test at least four paths: no choice, reject all, accept all and a selective choice. After each action, reload the page and navigate to a second page with a different feature. Inspect both the stored preference and the network. A button that changes the banner but leaves a tag active has not implemented the visitor’s choice. A tag that remains blocked after opt-in may be a product bug even if it is safer than the opposite error.

Confirm that the preference survives for the stated period and that acceptance and rejection are retained for the same duration, as the Cyprus Commissioner requires. Do not cause repeated prompts only for visitors who reject. If the site stores the preference in local storage rather than a cookie, test the resulting behaviour; the implementation detail does not remove the need for an informed, effective choice.

Check the tag manager and any server-side analytics pathway. A browser blocking test may miss events sent by another part of the stack after a page action. Trace which consent state is available to that pathway and how it changes after a rejection. Record the limits of what the test establishes. Separate verified behaviour from an assumption based solely on a tag manager configuration screen.

Basis and guidance: Cyprus Commissioner: cookies guidance

Make withdrawal as easy as giving consent

Provide a visible, consistent route to reopen the preference controls from the site. The EDPB taskforce recognises several possible designs, including a link in a standard visible location; it does not prescribe a permanent floating icon. The Cyprus Commissioner says visitors must be able to change their choice later and withdraw with equal ease. Test the route from both long and short pages.

When consent is withdrawn, update the preference immediately and stop the optional activity going forward. Inspect the network after reopening settings and saving the new state. If the provider placed an optional cookie, determine what can be removed by the site and what further information the visitor needs about third-party storage. Do not claim that revocation erased all prior processing if that has not been established.

Test keyboard and mobile access to the control. A footer link can appear in markup yet be covered by a sticky contact bar on a small screen. Verify an ordinary click without forced automation, and check that the control is reachable after the banner has been dismissed. The operational test matters more than a screenshot showing the label somewhere on the page.

For a connected task, read the retention-schedule guide.

Basis and guidance: Cyprus Commissioner: cookies guidance; EDPB: Cookie Banner Taskforce report

Handle embeds, blocked scripts and errors deliberately

Video, maps, scheduling tools and chat widgets can load external code before a visitor opens them. Inventory the real behaviour and configure each embed to respect the relevant choice. Where an optional tool stays inactive, provide a useful placeholder that explains how the visitor can enable it. Do not force acceptance of unrelated marketing purposes merely to view one requested feature.

Test the site with optional scripts blocked or failing. A contact form should still report an honest result, and navigation should remain usable. Consent software itself should not depend on a marketing request succeeding. Review any tag manager fallback that might start tags when the preference is unavailable. Use error logs and safe test interactions to find cases a normal visit would miss.

After a deployment, check that consent configuration and provider settings have not diverged. A change in the script loader can bypass a banner that previously worked. Assign a person to review new tags during release work and define a quick response when a tag is found running without its required choice. Keep corrective evidence alongside the configuration change.

Where an overseas provider receives personal data, review the international-transfer guide.

Example: a booking page with analytics and a calendar embed

Consider a hypothetical Cyprus professional-services website with audience analytics and an embedded booking calendar. On a clean visit, the analytics loader remains off while the banner is unanswered. The calendar appears as a placeholder until the visitor opens it or makes the relevant informed choice, depending on how the feature is designed. The test records what requests occur at each step.

The visitor rejects optional analytics and then opens the booking feature. The team checks which data the booking interaction sends to its provider and whether unrelated marketing tools remain off. A calendar script cannot be assumed strictly necessary for every page merely because appointments are important to the business. The choice design must reflect the actual service requested at that moment.

The visitor later returns and changes the analytics preference. The site applies the new state without requiring a new account or extra navigation. The team tests the normal mobile interface and a page reload. The example illustrates a testing method; the applicable legal result still depends on the technology and deployment details actually used.

For a connected task, read the processor-agreement checklist.

Keep evidence, owners and a review trigger

Keep the inventory, classification decisions, public copy, configuration and test results together. Record which version of the site was tested and when. A release checklist should include new scripts, changed provider purposes, updated category text and mobile interaction. A one-time banner review cannot establish the state after later campaigns or integrations.

Assign an owner for the website’s consent mechanism and one for the provider inventory. Establish a route for marketing and development teams to propose a new tool before loading it. Review the detailed notice when technology changes, and verify the result in production. Where an issue is found, record the affected pages and states, correction and confirmation rather than merely noting that the vendor settings were updated.

Use the evidence to make plain, accurate statements to visitors. Avoid promising that data is anonymous or that every third party is inactive unless the deployed tools and their settings support the claim. Zeno can coordinate independent privacy and technical support where a particular technology or choice needs case-specific review.

For a connected task, read the DPIA planning guide.

Primary sources and scope

Sources checked: October 4, 2026. This guide concerns the Republic of Cyprus. Examples are hypothetical, not client case studies. Check current official requirements before making a filing.

• Cyprus Commissioner: cookies guidance
• EDPB: Guidelines 05/2020 on consent
• EDPB: Cookie Banner Taskforce report